215022a08578122d44ea292077b38e61b494f782b1dd33b4da779626f8c4e6dd | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:40

Sharing

Report Analysis Logs

General

Target

1c03d35d09c247c2e6c4e73e5d9c13c3.dll
Size

6KB
MD5

1c03d35d09c247c2e6c4e73e5d9c13c3
SHA1

3ace028ea85ad1fbb941efce924a67d21a51d990
SHA256

215022a08578122d44ea292077b38e61b494f782b1dd33b4da779626f8c4e6dd
SHA512

a6d52c3aa7cff3278b8e6f84ff1735b6281990dc608f659562d3e6014462429e264330343d0ae2b110e9280bb0121a313fdc2c430b94e2132d9dbfc73333a31c
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0bB+BDq9J5SC:8qtV0HAr4+B+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 4028	5800	rundll32.exe	14
PID 5800 wrote to memory of 4028	5800	rundll32.exe	14
PID 5800 wrote to memory of 4028	5800	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c03d35d09c247c2e6c4e73e5d9c13c3.dll,#1
1⤵
PID:4028

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c03d35d09c247c2e6c4e73e5d9c13c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads